Traefik is a modern, cloud-native reverse proxy and load balancer designed for microservices. It auto-discovers services from Docker labels, Kubernetes ingress, and other providers, and automatically provisions Let’s Encrypt TLS certificates. This guide installs Traefik v3 on Ubuntu 26.04 LTS with Docker.

Tested and valid on:

  • Ubuntu 26.04 LTS

Prerequisites

  • Ubuntu 26.04 LTS with Docker Engine and Docker Compose installed
  • A domain name pointed at the server
  • Port 80 and 443 open

Step 1 – Create Traefik Configuration

mkdir -p ~/traefik && cd ~/traefik
touch acme.json && chmod 600 acme.json

Step 2 – Create traefik.yml (static config)

cat > traefik.yml << 'EOF'
api:
  dashboard: true
  insecure: false
entryPoints:
  web:
    address: ':80'
    http:
      redirections:
        entrypoint:
          to: websecure
          scheme: https
  websecure:
    address: ':443'
certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /acme.json
      httpChallenge:
        entryPoint: web
providers:
  docker:
    exposedByDefault: false
EOF

Step 3 – Create docker-compose.yml

cat > docker-compose.yml << 'EOF'
services:
  traefik:
    image: traefik:v3
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./acme.json:/acme.json
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)'
      - 'traefik.http.routers.dashboard.entrypoints=websecure'
      - 'traefik.http.routers.dashboard.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.dashboard.service=api@internal'
      - 'traefik.http.routers.dashboard.middlewares=auth'
      - 'traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$HASH'
EOF

Step 4 – Start Traefik

docker compose up -d
docker compose logs -f traefik

Step 5 – Route a Service Through Traefik

Add labels to any service container:

labels:
  - 'traefik.enable=true'
  - 'traefik.http.routers.myapp.rule=Host(`app.example.com`)'
  - 'traefik.http.routers.myapp.entrypoints=websecure'
  - 'traefik.http.routers.myapp.tls.certresolver=letsencrypt'
  - 'traefik.http.services.myapp.loadbalancer.server.port=8080'

Step 6 – Access the Traefik Dashboard

Visit https://traefik.example.com to see the real-time dashboard with all routers, services, and middleware.

Step 7 – Add Rate Limiting Middleware

In your service labels:

- 'traefik.http.middlewares.ratelimit.ratelimit.average=100'
- 'traefik.http.middlewares.ratelimit.ratelimit.burst=50'
- 'traefik.http.routers.myapp.middlewares=ratelimit'

Conclusion

Traefik v3 is running on Ubuntu 26.04 LTS as a zero-configuration reverse proxy. It automatically provisions TLS certificates for all routed services and provides a real-time dashboard for monitoring your infrastructure.